メニュー
Apply when reviewing a pull request in Hyperledger Cacti. Covers PR scope, Conventional Commits, TypeScript conventions, public API surface, testing, security (OWASP Top 10), AI slop detection, and CI status.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
| name | code-review |
| description | Apply when reviewing a pull request in Hyperledger Cacti. Covers PR scope, Conventional Commits, TypeScript conventions, public API surface, testing, security (OWASP Top 10), AI slop detection, and CI status. |
Review every PR against this checklist. Prioritize blocking issues over nits. Leave a comment only when you have a concrete, actionable suggestion. Do not approve a PR — human maintainer approval is required.
| # | Check | Goal | Reference |
|---|---|---|---|
| 1 | PR scope | One logical unit; no bundled unrelated concerns | PULL.md §1–2 |
| 2 | Conventional Commits | Header ≤ 72 chars; correct type prefix; PR title matches linked issue | CONVENTIONS.md §8 |
| 3 | TypeScript conventions | I prefix on interfaces; no any/console.log/eval; Prettier format | CONVENTIONS.md §5 |
| 4 | Public API surface | New types in public-api.ts; no manual edits to generated/ | CONVENTIONS.md §4 |
| 5 | Package conventions | cacti- prefix; tsconfig.base.json extended; cactus-test-tooling devDep only | CONVENTIONS.md §3–4 |
| 6 | Testing | Failing test for every behaviour change; port 0; no coverage bloat | CONVENTIONS.md §7, PULL.md §3 |
| 7 | Security (OWASP Top 10) | No secrets/injection/permissive CORS/verbose errors; SHA-pinned Actions | SECURITY.md |
| 8 | AI slop | No restatement comments, single-caller abstractions, hallucinated APIs | AI_GUIDELINES.md |
| 9 | CI status | Fetch the PR's actual check-run results; report any failing checks | PR state |
Flag the following as requiring resolution before merge:
// increment i by 1 above i++.data, result, obj, handler where a domain name is possible.Blocking / Required / NitCI for check-run failures)Do not post a comment without a concrete suggestion.
10-step checklist for safely removing one or more packages from the Cacti monorepo. Covers inventory, dependency scan, TypeScript import audit, CI workflow cleanup, tsconfig references, test-tooling helpers, directory deletion, lockfile regeneration, tracking-doc update, and verification pass.
Triage Cacti CI failures on a PR or main branch, fetch failing job logs via gh CLI, categorize root causes, and produce a structured markdown report at docs/ci-reports/. Use when the user asks why CI is failing, asks for a CI failure report, references a failing PR or run, mentions GitHub Actions failures, or asks to analyze/diagnose pipeline issues in the Hyperledger Cacti monorepo.
Analyze code for common vulnerability patterns using CodeQL-style queries. Identify injection flaws, unsafe deserialization, prototype pollution, path traversal, and other security issues in TypeScript/JavaScript code.
Cross-verify assertions, assumptions, and logic in code or explanations. Use as a quality gate before committing changes. Re-reads relevant code and confirms correctness.
Generate a structured refactoring plan for a Cacti package or module. Analyzes current code structure, identifies improvement opportunities, and produces a phased plan with risk assessment.
<One sentence describing what knowledge this skill provides.>